The main reason your code doesn't work, is that you have sent two \n's to the browser, before you attempt to redirect it. Once you have sent the double carriage returns, it's game over, anything printed to the browser after that is considered content. That is, as long as you've specified the Content-Type at some point before the carriage returns.

The key is to redirect the browser, if you need to, before printing the Content-Type, and sending the double carriage returns.

The follow code snippet will allow you to specify a list of bad domains, and redirects the user back to the bad domain if a match is found:

#!/usr/bin/perl -wT

use strict;
use CGI;
use URI;

use constant BAD_DOMAINS => qw(
  www.baddomain.com
);

#create lookup table
my %bad_domains;
undef @bad_domains{ BAD_DOMAINS() };

my $cgi = CGI->new;

print $cgi->redirect($cgi->referer)
  if exists $bad_domains{ URI->new($cgi->referer, 'http')->host };

print $cgi->header;

#...
[download]